= SSL =

== openssl certificate + key generation ==
{{{
openssl req -new -x509 -days 3650 -nodes -out /etc/ssl/certs/http2.pem -keyout /etc/ssl/private/http2.pem
Country Name: PT
Country Name (2 letter code) [XX]:PT
State or Province Name (full name) []:State
Locality Name (eg, city) [Default City]:City
Organization Name (eg, company) [Default Company Ltd]:example
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:*.example.org
Email Address []:user@example.org
}}}

== Check https connection ==
{{{
openssl s_client -connect wiki.bitarus.allowed.org:443
}}}

== Multiple SSL nginx ==
http://nginx.org/en/docs/http/configuring_https_servers.html

== Multiple SSL Apache ==
https://wiki.apache.org/httpd/NameBasedSSLVHosts

As a rule, it is impossible to host more than one SSL virtual host on the same IP address and port.

It is acceptable to use a single SSL configuration for several virtual hosts. In particular, this will work if the SSL certificate applies to all the virtual hosts. For example, this will work if:

All the VirtualHosts are within the same domain, eg: one.example.com and two.example.com.
You have a wildcard SSL certificate for that domain (one where the Common Name begins with an asterix: i.e *.example.com)

== Encrypt and decrypt with openssl + rsa keypair + base64 ==
{{{#!highlight bash
# generate rsa key pair
openssl genrsa -out private.pem 2048
# export public key 
openssl rsa -in private.pem -outform PEM -pubout -out public.pem

rm test.txt test.txt.bin.enc test.txt.bin.enc.b64 decoded.enc test.txt.bin
echo -n "test" > test.txt
hexdump -C test.txt
# encrypt with public key
openssl rsautl -encrypt -inkey public.pem -pubin -in test.txt -out test.txt.bin.enc
# encode 
base64 test.txt.bin.enc > test.txt.bin.enc.b64
# decode
base64 -d test.txt.bin.enc.b64 > decoded.enc
# decrypt with public key 
openssl rsautl -decrypt -inkey private.pem -in decoded.enc -out test.txt.bin
hexdump -C test.txt.bin
}}}


=== encrypt.sh ===
{{{#!highlight bash
# ssh-keygen
# openssl rsa -in id_rsa -outform PEM -pubout -out id_rsa.pub.pem
MESSAGE=message.txt
MESSAGE_ENC=message.txt.enc
MESSAGE_ENC_B64=message.txt.enc.b64
PUB_KEY=~/.ssh/id_rsa.pub.pem

echo -n $1 > $MESSAGE
openssl rsautl -encrypt -inkey "$PUB_KEY" -pubin -in "$MESSAGE" -out "$MESSAGE_ENC" 
base64 $MESSAGE_ENC > $MESSAGE_ENC_B64
cat $MESSAGE_ENC_B64
}}}

=== decrypt.sh ===
{{{#!highlight bash
OUT_MESSAGE=message.txt.dec
MESSAGE_ENC_B64=message.txt.enc.b64
DECODED_ENC=message.dec.enc
PRV_KEY=~/.ssh/id_rsa
 
base64 -d $MESSAGE_ENC_B64 > $DECODED_ENC
openssl rsautl -decrypt -inkey $PRV_KEY -in $DECODED_ENC -out $OUT_MESSAGE
cat $OUT_MESSAGE
}}}

== https://gethttpsforfree.com/ ==
{{{
cd ~
openssl genrsa 4096 > httpsforfreeaccount.key
openssl rsa -in httpsforfreeaccount.key -pubout > httpsforfreeaccount.pub
openssl genrsa 4096 > domain.key
openssl req -new -sha256 -key domain.key -subj "/" \
  -reqexts SAN -config <(cat /etc/ssl/openssl.cnf \
  <(printf "\n[SAN]\nsubjectAltName=DNS:foo.com,DNS:www.foo.com"))
}}}

== https://www.sslforfree.com/ ==


== Get expiration date ==
 * echo | openssl s_client -servername www.bitarus.allowed.org -connect www.bitarus.allowed.org:443 2>/dev/null | openssl x509 -noout -enddate
{{{#!highlight python
import time
t = time.strptime('Aug 23 12:35:40 2019 GMT','%b %d %H:%M:%S %Y %Z')
time.mktime(t) - time.time()
####
import ssl
import socket
context = ssl.create_default_context()
context.check_hostname = False
context.verify_mode = ssl.CERT_NONE
conn = context.wrap_socket(socket.socket(socket.AF_INET),server_hostname="www.bitarus.allowed.org")
connection = conn.connect(("www.bitarus.allowed.org",443))
cert = conn.getpeercert()
}}}